CVE-2026-44831: Snipe-IT: XSS vulnerability in component notes
Impact Users with component view access could be impacted by an unescaped notes column.
Patches This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater.
Workarounds None.
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.4.1 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.4.1Patch 28f493d84d057895fbb93b6570e7393a2c2fa438
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44831?
CVE-2026-44831 is considered a moderate severity vulnerability affecting users with component view access.
How do I fix CVE-2026-44831?
To fix CVE-2026-44831, upgrade to version 8.4.1 or greater of the snipe/snipe-it package.
What vulnerability does CVE-2026-44831 address?
CVE-2026-44831 addresses an unescaped 'notes' column that can impact users with component view access.
Are there any workarounds for CVE-2026-44831?
No, there are no known workarounds for CVE-2026-44831; upgrading is necessary.
What versions of snipe-it are affected by CVE-2026-44831?
Versions prior to 8.4.1 of the snipe/snipe-it package are affected by CVE-2026-44831.